Edit tour

Windows Analysis Report
Leistungsansicht.pdf

Overview

General Information

Sample name:	Leistungsansicht.pdf
Analysis ID:	1523482
MD5:	17cb9d85c7d15ad6c25f989809451761
SHA1:	c5a930f43eead1dcbbd0cc73957e7f3beb2a9e2d
SHA256:	76200be8716ae57fd9ee97389c4d087446594aaa093e680a1c4d01b7b6ff3e28
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

PDF is encrypted

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 5660 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Leistungsansicht.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1724,i,542157055565685941,14404819011696683976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443

Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: classification engine

Classification label: clean3.winPDF@14/28@3/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-51-26-384.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Leistungsansicht.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1724,i,542157055565685941,14404819011696683976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1724,i,542157055565685941,14404819011696683976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Leistungsansicht.pdf	Initial sample: PDF keyword /JS count = 0
Source: Leistungsansicht.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /JBIG2Decode count = 20

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: Leistungsansicht.pdf

Initial sample: PDF keyword stream count = 914

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Leistungsansicht.pdf

Initial sample: PDF keyword endobj count = 916

Source: Leistungsansicht.pdf

Initial sample: PDF keyword endstream count = 914

Source: Leistungsansicht.pdf

Initial sample: PDF keyword obj count = 916

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /Encrypt

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://x1.i.lencr.org/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523482
Start date and time:	2024-10-01 16:50:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Leistungsansicht.pdf
Detection:	CLEAN
Classification:	clean3.winPDF@14/28@3/1
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 107.22.247.231, 54.144.73.197, 18.207.85.246, 34.193.227.236, 172.64.41.3, 162.159.61.3, 2.22.242.123, 2.22.242.11, 2.23.197.184, 2.19.126.143, 2.19.126.149
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
VT rate limit hit for: Leistungsansicht.pdf

Simulations

Behavior and APIs

Time	Type	Description
10:51:36	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.200.196.138	report_209.pdf	Get hash	malicious	Unknown	Browse
	Statement 2024-14.pdf	Get hash	malicious	Unknown	Browse
	uenic.msi	Get hash	malicious	Unknown	Browse
	https://img1.wsimg.com/blobby/go/672d0f54-9add-420a-a58c-ef66bcb1ba03/downloads/sijapej.pdf	Get hash	malicious	Unknown	Browse
	c.cmd	Get hash	malicious	CarnavalHeist	Browse
	Voice_Message.pdf	Get hash	malicious	HTMLPhisher	Browse
	ADJUSTMENT ON PAY RISE FOR ALL FACULTY AND STAFF.pdf	Get hash	malicious	HTMLPhisher	Browse
	v2.1.pdf	Get hash	malicious	Unknown	Browse
	Sfoster REM.993510.pdf	Get hash	malicious	Unknown	Browse
	DOC-66642820.pdf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NOS_COMUNICACOESPT	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	89.154.247.83
	report_209.pdf	Get hash	malicious	Unknown	Browse	23.200.196.138
	https://novo.oratoriomariano.com/novo/99417/Entry.html	Get hash	malicious	Unknown	Browse	88.157.228.52
	http://novo.oratoriomariano.com/novo/94694/	Get hash	malicious	Unknown	Browse	88.157.228.52
	https://novo.oratoriomariano.com/novo/92164/	Get hash	malicious	Unknown	Browse	88.157.228.52
	Statement 2024-14.pdf	Get hash	malicious	Unknown	Browse	23.200.196.138
	uenic.msi	Get hash	malicious	Unknown	Browse	23.200.196.138
	jade.arm7.elf	Get hash	malicious	Mirai	Browse	94.132.45.220
	jade.mips.elf	Get hash	malicious	Mirai	Browse	94.132.45.255
	jade.mpsl.elf	Get hash	malicious	Mirai	Browse	95.92.102.18

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.197667909288997
Encrypted:	false
SSDEEP:	6:q0gxq2PN72nKuAl9OmbnIFUt8L0FZmw+L0XkwON72nKuAl9OmbjLJ:qNvVaHAahFUt8LC/+Lu5OaHAaSJ
MD5:	7E5228F55B412F247236FB131D86A749
SHA1:	5924B83AEE3BDF412D57BDB7B6497B2FB43DD727
SHA-256:	2CF0770BC02A7576D3144D4E091AE4AB1010A0E73E9CC88F4BA71FE1A45F5D09
SHA-512:	447A43C27F676E8BC3009B41BC398F59C2956A71A4DF24A1DAABA69BE314A7FAAEB89835A45A78D778D20B40EA24DF22F3671FFC853052DF8F75DC2E14751C6B
Malicious:	false
Reputation:	low
Preview:	2024/10/01-10:51:24.074 894 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-10:51:24.076 894 Recovering log #3.2024/10/01-10:51:24.076 894 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.197667909288997
Encrypted:	false
SSDEEP:	6:q0gxq2PN72nKuAl9OmbnIFUt8L0FZmw+L0XkwON72nKuAl9OmbjLJ:qNvVaHAahFUt8LC/+Lu5OaHAaSJ
MD5:	7E5228F55B412F247236FB131D86A749
SHA1:	5924B83AEE3BDF412D57BDB7B6497B2FB43DD727
SHA-256:	2CF0770BC02A7576D3144D4E091AE4AB1010A0E73E9CC88F4BA71FE1A45F5D09
SHA-512:	447A43C27F676E8BC3009B41BC398F59C2956A71A4DF24A1DAABA69BE314A7FAAEB89835A45A78D778D20B40EA24DF22F3671FFC853052DF8F75DC2E14751C6B
Malicious:	false
Reputation:	low
Preview:	2024/10/01-10:51:24.074 894 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-10:51:24.076 894 Recovering log #3.2024/10/01-10:51:24.076 894 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.131034270941074
Encrypted:	false
SSDEEP:	6:q0/0Vq2PN72nKuAl9Ombzo2jMGIFUt8L0QAgZmw+L0QAIkwON72nKuAl9Ombzo23:qZVvVaHAa8uFUt8LHAg/+LHAI5OaHAaU
MD5:	32085AE921605A53E745E5A04238616C
SHA1:	55017BD66179F5C6240EFD5486D2084EEE488B4E
SHA-256:	AC4F1FAFFC6FE7B92A95A0206CEAE41B641FB842F2444E7FD7BB094E7A52D25B
SHA-512:	B8AB92F7DBDA8F8AAE6C531C7BE0A2F03B6054DA27B83BEF3E0DE1C6B545F2D2C465ED7F5909EEF84D23D2414DB50FD41F2D33800C17455253D0F8AC391A0441
Malicious:	false
Reputation:	low
Preview:	2024/10/01-10:51:24.115 d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-10:51:24.116 d94 Recovering log #3.2024/10/01-10:51:24.116 d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.131034270941074
Encrypted:	false
SSDEEP:	6:q0/0Vq2PN72nKuAl9Ombzo2jMGIFUt8L0QAgZmw+L0QAIkwON72nKuAl9Ombzo23:qZVvVaHAa8uFUt8LHAg/+LHAI5OaHAaU
MD5:	32085AE921605A53E745E5A04238616C
SHA1:	55017BD66179F5C6240EFD5486D2084EEE488B4E
SHA-256:	AC4F1FAFFC6FE7B92A95A0206CEAE41B641FB842F2444E7FD7BB094E7A52D25B
SHA-512:	B8AB92F7DBDA8F8AAE6C531C7BE0A2F03B6054DA27B83BEF3E0DE1C6B545F2D2C465ED7F5909EEF84D23D2414DB50FD41F2D33800C17455253D0F8AC391A0441
Malicious:	false
Reputation:	low
Preview:	2024/10/01-10:51:24.115 d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-10:51:24.116 d94 Recovering log #3.2024/10/01-10:51:24.116 d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9764364769502185
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5AgxsBdOg2HxAcaq3QYiubcP7E4T3y:Y2sRdsTJdMHh3QYhbA7nby
MD5:	5A18856A6F62CDCD66D922BF73240611
SHA1:	59910BFDE51D050F7E2C0BBDA4B2A2E4CF206738
SHA-256:	DBA51FB88B08352D0FC600D1F9E83ABC0A6EA2BCEBA3CF678865D4BB484625B4
SHA-512:	35DE46E686B22811E069D7DCE4CA3375228961FDABBAEF3AF7F3CB0374151636FC044802B2D6A1AA4D85103D7C5538F35E85BF370ED54807D1D4414EEC114A04
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372354296210728","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140580},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9cd5be6-efa6-4fc2-9722-78e4ae0c451f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9764364769502185
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5AgxsBdOg2HxAcaq3QYiubcP7E4T3y:Y2sRdsTJdMHh3QYhbA7nby
MD5:	5A18856A6F62CDCD66D922BF73240611
SHA1:	59910BFDE51D050F7E2C0BBDA4B2A2E4CF206738
SHA-256:	DBA51FB88B08352D0FC600D1F9E83ABC0A6EA2BCEBA3CF678865D4BB484625B4
SHA-512:	35DE46E686B22811E069D7DCE4CA3375228961FDABBAEF3AF7F3CB0374151636FC044802B2D6A1AA4D85103D7C5538F35E85BF370ED54807D1D4414EEC114A04
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372354296210728","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140580},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5859
Entropy (8bit):	5.2442211412176
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE72YGzW:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh7
MD5:	F2B0DA2E04A1D5685C1FCC6155B1D7B6
SHA1:	DC178426E3CFED42E1B7FC9193FE18E481AB71F9
SHA-256:	A810042D1986D13B0BB8C718D02B350EADA98D7E6F5775A482BBCADC3931D627
SHA-512:	F97556AEF3A371DCDC2D2955346574CEA230E8E1554AD0393FFB18320F660B3F5A5535CE7558729EA8265EA8000F04AF383B9838CBDC615E9A6DFBEC00FEFFE1
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.154421792335983
Encrypted:	false
SSDEEP:	6:q0cVq2PN72nKuAl9OmbzNMxIFUt8L07SAgZmw+L07SAIkwON72nKuAl9OmbzNMFd:q1VvVaHAa8jFUt8Lwzg/+LwzI5OaHAab
MD5:	9021A546D41A70F55290ABB07CD56033
SHA1:	A1D27B49471315D3D6870CD9F743FB68AE2F03B9
SHA-256:	942D06A070EE1A4C32DE8AF48B5C5543D62F476C1EFF537486FDD3A874174CE6
SHA-512:	755D3FCE0AF4673C0513FBF07ADAF59C6144897256C9B9C096D75CFAECBA22B679069F4A648EFF0A49846A8C692F64FC50C9EE8C183D5F2EAA1C87A337FDB765
Malicious:	false
Reputation:	low
Preview:	2024/10/01-10:51:24.238 d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-10:51:24.239 d94 Recovering log #3.2024/10/01-10:51:24.239 d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.154421792335983
Encrypted:	false
SSDEEP:	6:q0cVq2PN72nKuAl9OmbzNMxIFUt8L07SAgZmw+L07SAIkwON72nKuAl9OmbzNMFd:q1VvVaHAa8jFUt8Lwzg/+LwzI5OaHAab
MD5:	9021A546D41A70F55290ABB07CD56033
SHA1:	A1D27B49471315D3D6870CD9F743FB68AE2F03B9
SHA-256:	942D06A070EE1A4C32DE8AF48B5C5543D62F476C1EFF537486FDD3A874174CE6
SHA-512:	755D3FCE0AF4673C0513FBF07ADAF59C6144897256C9B9C096D75CFAECBA22B679069F4A648EFF0A49846A8C692F64FC50C9EE8C183D5F2EAA1C87A337FDB765
Malicious:	false
Reputation:	low
Preview:	2024/10/01-10:51:24.238 d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-10:51:24.239 d94 Recovering log #3.2024/10/01-10:51:24.239 d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001145128Z-209.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.87521706896166
Encrypted:	false
SSDEEP:	96:0UjSIAqmA7Nqq8cNYtUudW5JZ+ulv7a4x1MMMHM4ME4MmMMMDMMMMMM1aMRo/MMn:VgqlBKciK7eaWIu1ZZESnEzlR/hxh
MD5:	8AD5FB1144A1FDF61B16E52558C592CD
SHA1:	3C0933D781941350A7F888674F7B98720B5703B8
SHA-256:	B08741D888ED130EC61B6C6A4F15E1178F9F7ECBF374A6DF1CE1DE6C6405A294
SHA-512:	EE4FFBF19FE1051CECA60292CE14DD69AAB6EB534CF9D6BC17BC824C5A6944A6E55868B571CF1D215974F0043D01487363CF351F2DE9AD27907D8BBA9FFF5DED
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44463979728695
Encrypted:	false
SSDEEP:	384:ye6ci5tAiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mXs3OazzU89UTTgUL
MD5:	B96F09B47A31EFFCABE701A9C0548189
SHA1:	6BAB3C7BC9FA1889A670CF09B94C62A471340850
SHA-256:	98A0130D4A6E1DAEA1DBE4E0C0FFABC46E4910B3A627AB783816778B651E90AD
SHA-512:	678A09BBE332C41DAD8B6C395834443A922DC7A29584989A8C333DDC7A5949DBFBB6F35F370C8C854CA933B35A9C2312BA86872572F7B1006573D2F3D31F95AE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766651707586134
Encrypted:	false
SSDEEP:	48:7MYJioyVwioyzoy1C7oy16oy1qKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7vJuwVxXjBiib9IVXEBodRBkL
MD5:	027FBF94248EC5E6C823C2FF1C60C22F
SHA1:	6D4B3BD3D6E6130C91CB1FA0B6EEBC7D1B99DDF8
SHA-256:	AFDE77281DDCB51A1EC5C83FC3FDA08F6B7EA96B93C883B25CE939A1FD143CAF
SHA-512:	A213C6FBE99A8ACAFB628C5833B0ADE94C102E7776891A2007D3237813CC868DEC09E549443B15007374E8E357F138692AAC92887816660B65F8EB466A6025D5
Malicious:	false
Preview:	.... .c.....3..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7621925687296174
Encrypted:	false
SSDEEP:	3:kkFklYIvfllXlE/HT8kwKKNNX8RolJuRdxLlGB9lQRYwpDdt:kKBIQT8UaNMa8RdWBwRd
MD5:	999EFBC2B7684EBB1E39B26D10E23E8D
SHA1:	FA4B26683CB6D7115920433C4F67A2C54D6A6F64
SHA-256:	0A53EEDA6EF0F189D37330F37958EB2F52F810D3D54F2D024E0B5B49611771F3
SHA-512:	C3A1630FC9AE18EEF9B49105CAE2528F4E2DC058D7C0CC9D13AFA1861CCDA9BD53817F24C87B59A1D849D423B6520FEEB179FC13398B2E097D026A7383519E60
Malicious:	false
Preview:	p...... ........+$dj....(....................................................... ..........W...../..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:	1536:qKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:XPCaJ/3AYvYwglFoL+sn
MD5:	265E3E1166312A864FB63291EA661C6A
SHA1:	80DFF3187FF929596EB22E1DB9021BAD6F97178C
SHA-256:	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
SHA-512:	48776A2BFE8F25E5601DCC0137F7AB103D5684517334B806E3ACF61683DD9B283828475FC85CE0CBE4E8AF88E6F8B25EED0A77640E2CFFF2CC73708726519AFA
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.072671370341132
Encrypted:	false
SSDEEP:	48:Yx/pOrY21a4hbtC3dci5WXjJ0vS/PbMa7:3B0tWTJDnbMo
MD5:	12D2F045C5038F11CF19FE2D7CAA171F
SHA1:	5F9CBB04C6E79D838E8FCB207FE6406A3A829578
SHA-256:	5C5E44DA9C4229497A1FEED80BE94AC52CA6A408D067D9ABEE26AE1FF89BFDCC
SHA-512:	CA108AFCC3654BF42586559D1CD66443806B7370BB74D825B70AA981F54735CE0954C3F16A5B027A2CCC844F718B5B14560462A6DAD1312CCE8FC72AAD5B8668
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1727794287000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"380dd703fc581680761b4186c45e2d38","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696488387000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"35166e54b6efd9393ba2006ee9cc09b6","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696488385000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f776fac6300c02bf0731dc513183b5e8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696488373000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"78cf3d8961acebfb4fcfb54de4ad804c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696486847000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4bd607a1e654cbca833e725de7ae4339","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696486847000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1468678334328266
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursNo9XJXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUt:TGufl2GL7ms2Xc+XcGNFlRYIX2vbCz
MD5:	8CF79C6C2F5D921AAFF830AD9E8C1331
SHA1:	3508A8EC2AC6B1BF07494101EE8073DC4B050B5A
SHA-256:	DB615C0430081D9B85CD153C4FAC5302F52D090B052637F6FD03ED4487D5C879
SHA-512:	53B872E6859213497D10EBD9259CB5A51EAE37EF992BD85FF72E809D9AD98D1745980DA08468965EC788125E405B828875CD8CEF70CEE5BF69FD5105A84D6ACD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5542375898894145
Encrypted:	false
SSDEEP:	24:7+tDy9RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRulkr9eqLhx/d:7MDIXc+XcGNFlRYIX2v3kYqFl2GL7msb
MD5:	991A1D899EB99DB9F9B96FD4D5F26944
SHA1:	32B3795125A63CAF4118320FB1C92990D7093893
SHA-256:	99C3E130182136560C734D9461CE1E076E474DED8242705DB89F4ED04E851315
SHA-512:	E388CB3D8264216767B1A1CB91BD9C5BE9B269535C658FD9D15AC8E1667E3EA0541664B5254CEC85C8B05A00A559477E24379BDDAB88EC3D14D101E21E5039CA
Malicious:	false
Preview:	.... .c.......l%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b...b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2e9d4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K80QRqdNY3flH:Qw946cPbiOxDlbYnuRKsflH
MD5:	26B1670EE207C877E7CAD94495D81003
SHA1:	BF2216BAD5FE60604506E28E615771F52825F6EA
SHA-256:	E464012E5E63E26550F1E19C8B29CD5F6655109224BC7A19F9CA732163D18259
SHA-512:	115E08FE5A77F2FCC02A666B644E3356DCAFCA478FD648292129E1285EB553EE011AE37113A35E01F5AC74DB1DD91B623947BC9456B87968909F3C335070DAA1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.1./.1.0./.2.0.2.4. . .1.0.:.5.1.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-51-26-384.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.345333179644277
Encrypted:	false
SSDEEP:	384:cfVSdXcNkBE47CFCZPQpo+SMQfiRKMsHlWCwbztTa0BMOuZUG/WauTuTWs+QD80W:qcy
MD5:	680D9FAA3475D4ED44AB2BD5210C7C1B
SHA1:	9E83C0B836E49B9FF5684BA1DE2EC154010B3F8F
SHA-256:	688FD9917493375A6AE52E429CF3C4B4F244A29C41B738BD8049F3D7CBE78F47
SHA-512:	CF94F84FEC16F40B151B5B4D58B9934F064B5D277103B33F41ED4E23D8F6A9E8C6C5F65B460E6A7A8E707DD76E8AF339190AA043C1421D0FB16BB25893A648FB
Malicious:	false
Preview:	SessionID=dee9b18e-befb-4c05-ba18-0872e1bc75fc.1727794286399 Timestamp=2024-10-01T10:51:26:399-0400 ThreadID=3472 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dee9b18e-befb-4c05-ba18-0872e1bc75fc.1727794286399 Timestamp=2024-10-01T10:51:26:399-0400 ThreadID=3472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dee9b18e-befb-4c05-ba18-0872e1bc75fc.1727794286399 Timestamp=2024-10-01T10:51:26:399-0400 ThreadID=3472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dee9b18e-befb-4c05-ba18-0872e1bc75fc.1727794286399 Timestamp=2024-10-01T10:51:26:399-0400 ThreadID=3472 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dee9b18e-befb-4c05-ba18-0872e1bc75fc.1727794286399 Timestamp=2024-10-01T10:51:26:399-0400 ThreadID=3472 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396268375995142
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbYcbgIJ/cbZ:V3fOCIdJDeZJ0
MD5:	06A133CA340E0885A69D047EABD30771
SHA1:	F27CAEF960B303943ADAE9A6BE697DDAB6EED43B
SHA-256:	2CBFAAC43FF69C78D86B830F9430938F06C8A2E492555C745845BC1BF8FC8003
SHA-512:	EBC66E1DAE1331E05EBCF3E41120A0B5D8EBA8FD9C8EAD8C004FA5DA64E420A44A7376295939D398892C20E7A28321D5020B0C24CC6C77C89347D9605560B774
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\007b7297-bf09-4823-9da8-6e80201e5a35.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4725409a-4889-4e5c-8064-a5112f7548de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\843fb714-a842-4ad1-928e-d5aed9943e22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/2wYIGNP4aWLqj7oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:OwZG6aWLfBGZN3mlind9i4ufFXpAXkru
MD5:	5543B35CEADFDC4687E8A5935321BDC9
SHA1:	545A39A2EBFC69D0CD56E1018E8F365ADA4F5793
SHA-256:	35D8C0C28C986ED26CCB41F55E9F66C70CE705D247A90259314A378DD5E68ACD
SHA-512:	6AF4D323364C478018B288D51CB3EDE8265DF62A9D44BD141D621AB6F833B907E010B3266FB8BDEB38A541720E68D47A1F945AA4F88F29571BC6E06E69C2D405
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c1ee7c19-4f7a-4bf4-811d-c9901312b4e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.66829583405449
Encrypted:	false
SSDEEP:	3:So6FwHn:So6FwHn
MD5:	DD4A3BD8B9FF61628346391EA9987E1D
SHA1:	474076C122CACAAF112469FC62976BB69187AA2B
SHA-256:	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
SHA-512:	FDAF3D9F8072ED7DE9B2528376C10E3C3FDBEA74347710A4795BECF23C6577B3582B2E89D3C04EF0523C98FE0A46F2AF3629490701A20B848C63BA7B26579491
Malicious:	false
Preview:	<</Settings [/c <<>>].>>

Static File Info

General

File type:	PDF document, version 1.6
Entropy (8bit):	7.86973006085187
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Leistungsansicht.pdf
File size:	923'532 bytes
MD5:	17cb9d85c7d15ad6c25f989809451761
SHA1:	c5a930f43eead1dcbbd0cc73957e7f3beb2a9e2d
SHA256:	76200be8716ae57fd9ee97389c4d087446594aaa093e680a1c4d01b7b6ff3e28
SHA512:	19be3f78b4f20b83d7c8bfdcefc8d3f53d7963ff01e0c0bf7ad068f601e658521ae877b0d53e2b3df060a50cc33c0dd125abc25fa33f9d2bea8ff25b69d46ba3
SSDEEP:	24576:OFZUYTG0z5EnGJryR4LkMQ2PfQ2oSWaueJ/qlpj:Q2YT/96GJuR4xQ1xSlBhqlpj
TLSH:	C715BFFD526A1519D48645056E1C3AAB0ECED1B34D2928B33876C5CE3E9DE24F438BF8
File Content Preview:	%PDF-1.6.%.....2 0 obj.<<./Metadata 5 0 R./Pages 6 0 R./Type /Catalog.>>.endobj.3 0 obj.<<./CF <<./StdCF <<./AuthEvent /DocOpen./CFM /AESV3./Length 32./Type /CryptFilter.>>.>>./EncryptMetadata true./Filter /Standard./Length 256./O (EB\r.u:....]o..........

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.6
Total Entropy:	7.869730
Total Bytes:	923532
Stream Entropy:	7.998943
Stream Bytes:	763465
Entropy outside Streams:	5.221544
Bytes outside Streams:	160067
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	916
endobj	916
stream	914
endstream	914
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	1
/ObjStm	2
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	20
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 16:51:36.566623926 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:36.566678047 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:36.566740990 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:36.566953897 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:36.566972017 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.117933989 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.118299007 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.118329048 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.119344950 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.119406939 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.150873899 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.151042938 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.151246071 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.151268005 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.203825951 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.247626066 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.247710943 CEST	443	49729	23.200.196.138	192.168.2.6
Oct 1, 2024 16:51:37.247823000 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.248691082 CEST	49729	443	192.168.2.6	23.200.196.138
Oct 1, 2024 16:51:37.248713970 CEST	443	49729	23.200.196.138	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 16:51:36.650022984 CEST	53630	53	192.168.2.6	1.1.1.1
Oct 1, 2024 16:52:00.384318113 CEST	57869	53	192.168.2.6	1.1.1.1
Oct 1, 2024 16:52:24.730890036 CEST	61731	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 16:51:36.650022984 CEST	192.168.2.6	1.1.1.1	0x7a67	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 16:52:00.384318113 CEST	192.168.2.6	1.1.1.1	0xa67b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 16:52:24.730890036 CEST	192.168.2.6	1.1.1.1	0xd6bc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Oct 1, 2024 16:51:36.657727957 CEST	1.1.1.1	192.168.2.6	0x7a67	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 16:52:00.394078970 CEST	1.1.1.1	192.168.2.6	0xa67b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 16:52:24.738094091 CEST	1.1.1.1	192.168.2.6	0xd6bc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

armmf.adobe.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49729	23.200.196.138	443	3004	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 14:51:37 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-10-01 14:51:37 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Tue, 01 Oct 2024 14:51:37 GMT Connection: close

Target ID:	0
Start time:	10:51:21
Start date:	01/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Leistungsansicht.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:51:23
Start date:	01/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:51:24
Start date:	01/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1724,i,542157055565685941,14404819011696683976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Leistungsansicht.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9cd5be6-efa6-4fc2-9722-78e4ae0c451f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001145128Z-209.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI2e9d4.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-51-26-384.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

C:\Users\user\AppData\Local\Temp\acrocef_low\007b7297-bf09-4823-9da8-6e80201e5a35.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\4725409a-4889-4e5c-8064-a5112f7548de.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\843fb714-a842-4ad1-928e-d5aed9943e22.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\c1ee7c19-4f7a-4bf4-811d-c9901312b4e7.tmp

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

Static File Info

General

Windows Analysis Report
Leistungsansicht.pdf